389f762eb2fef604ece587e751fd432b595dfe26ff406cb5911e5cb120f96322

Analysis

max time kernel
94s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe
Size

3.2MB
MD5

fecfceea24f11a889a331cc7cf99956c
SHA1

993e324205cd22dc4d0922cc52009f1296bf7a8a
SHA256

389f762eb2fef604ece587e751fd432b595dfe26ff406cb5911e5cb120f96322
SHA512

4ec345cb2e7cc3cb303293bfd2d690fb611991b4f5ca7dca7ec1fa495941dfa3cf9b93f3f0172602c35c77211b7740f6448c460c5f05d484a47e1d9256501858
SSDEEP

49152:6zG1BqCBGJdodXAGRe5CFHRoHgmAZf1Ny:DBIKRAGRe5K2UZe

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3584	e576a91.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3608	3584	WerFault.exe	82

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e576a91.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2948	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe
2948	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe
3584	e576a91.exe
3584	e576a91.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 3584	2948	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe	82
PID 2948 wrote to memory of 3584	2948	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe	82
PID 2948 wrote to memory of 3584	2948	2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_fecfceea24f11a889a331cc7cf99956c_hacktools_xiaoba.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e576a91.exe
  C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e576a91.exe 240609984
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3584
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3584 -s 2056
    3⤵
    - Program crash
    PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3584 -ip 3584
1⤵
PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ÅäÖÃ\e576a91.exe

Filesize
3.2MB

MD5
9cd2db90def6e988cca0ff197e24d4a6

SHA1
2ef9490b06341abb3340fa51aa0b86d4299de7f7

SHA256
b6aaa0f128dbb60ba3a6e05cc0dbbccc68c8058413550a2de0b411bae28c3003

SHA512
15e43cba9a308904cd86faa21b904519dbfb1b5d2a3cbaf36d4bb0808206de6ac8546b70de85e102be4e17f0900adfe14c4b521e854b6b6f33c21ab36565e980

Download Submit
memory/2948-0-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2948-1-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/2948-18-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download
memory/3584-22-0x000000007611A000-0x000000007611B000-memory.dmp

Filesize
4KB

Download
memory/3584-26-0x0000000000400000-0x00000000007A5000-memory.dmp

Filesize
3.6MB

Download